Skip to content
OpenAdvisories
Medium USN-6401-1 10 CVEs

freerdp2 vulnerabilities

Published Oct 4, 2023 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FreeRDP did not properly manage certain inputs. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2023-39350, CVE-2023-39351, CVE-2023-39353,
CVE-2023-39354, CVE-2023-40181, CVE-2023-40188, CVE-2023-40589)

It was discovered that FreeRDP did not properly manage certain inputs. A
malicious server could use this issue to cause FreeRDP clients to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2023-40186, CVE-2023-40567, CVE-2023-40569)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS freerdp2 2.2.0+dfsg1-0ubuntu0.20.04.5
Ubuntu · 22.04 LTS 22.04:LTS freerdp2 2.6.1+dfsg1-3ubuntu2.4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS freerdp2 2.2.0+dfsg1-0ubuntu0.18.04.4+esm1

Vulnerabilities 10

  • Medium 6.5
    CVE-2023-40186

    IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects F…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2023-40567

    Out-Of-Bounds Write in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of th…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 6.5
    CVE-2023-40569

    Out-Of-Bounds Write in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2023-39350

    Incorrect offset calculation leading to denial of service in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.9
    CVE-2023-39354

    FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `con…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39351

    FreeRDP Null Pointer Dereference leading denial of service

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_ti…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-39353

    Missing offset validation leading to Out Of Bound Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset valida…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-40181

    Integer-Underflow leading to Out-Of-Bound Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemo…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 5.3
    CVE-2023-40188

    Out-Of-Bounds Read in FreeRDP

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Medium 4.3
    CVE-2023-40589

    FreeRDP Global-Buffer-Overflow in ncrush_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overfl…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2023-39350
  • report
    https://ubuntu.com/security/CVE-2023-39351
  • report
    https://ubuntu.com/security/CVE-2023-39353
  • report
    https://ubuntu.com/security/CVE-2023-39354
  • report
    https://ubuntu.com/security/CVE-2023-40181
  • report
    https://ubuntu.com/security/CVE-2023-40186
  • report
    https://ubuntu.com/security/CVE-2023-40188
  • report
    https://ubuntu.com/security/CVE-2023-40567
  • report
    https://ubuntu.com/security/CVE-2023-40569
  • report
    https://ubuntu.com/security/CVE-2023-40589